How Is HMAC Different From A Plain Hash?

A plain hash proves integrity only; HMAC mixes in a secret key, so a matching signature also proves the sender holds the key.

Which Encoding Do I Need?

Check the API's docs — webhook headers are usually hex (Stripe) or Base64 (Slack). Both are shown so you can match either.

HMAC Generator

Sign a message with a secret key — HMAC-SHA-1/256/384/512 signatures in hex and Base64, computed locally with Web Crypto.

Message & Key

Signed locally with the Web Crypto API — nothing leaves your browser.

Algorithm

MessageSecret Key

Hex Signature

Base64 Signature

HMAC proves both integrity and authenticity: only someone holding the same secret can produce a matching signature. Used by API webhooks (Stripe, GitHub), JWTs (HS256) and request signing.

Loading Tool…

What Is the HMAC Generator?

The HMAC Generator computes keyed-hash message authentication codes with the Web Crypto API. Pick HMAC-SHA-1, SHA-256, SHA-384 or SHA-512, enter your message and secret key, and read the signature in both hex and Base64 — the two encodings APIs actually use. Everything is signed locally; the key and message never leave your browser.

How It Works

Type or paste the message, enter the shared secret, choose the algorithm, and copy either output. The signature updates live as you type.

When to Use It

Use it to debug webhook signatures (Stripe, GitHub, Slack), verify HS256 JWT signing inputs, or test API request-signing code against a known-good value.

Frequently Asked Questions

How Is HMAC Different From A Plain Hash?: A plain hash proves integrity only; HMAC mixes in a secret key, so a matching signature also proves the sender holds the key.
Which Encoding Do I Need?: Check the API's docs — webhook headers are usually hex (Stripe) or Base64 (Slack). Both are shown so you can match either.

Found an issue? Send Feedback. See our data sources and update policy for tools that depend on changing information.